---
id: CVE-2026-48164
title: 'Collabora Online: Reflected HTML injection through host_session_id'
summary: >-
  Collabora Online is a collaborative online office suite based on LibreOffice
  technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form
  parameter is substituted into the `cool.html` editor page without HTML
  encoding, un…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: CollaboraOnline
product: online
affected:
  - online < 24.04.18
  - 'online >= 25.04.0-0, < 25.04.11'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:44:14.478525Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:44:29.766Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-48164'
references:
  - url: >-
      https://github.com/CollaboraOnline/online/security/advisories/GHSA-wgmm-q3ch-64jj
    label: >-
      https://github.com/CollaboraOnline/online/security/advisories/GHSA-wgmm-q3ch-64jj
  - url: >-
      https://github.com/CollaboraOnline/online/commit/2d4469d27f0c52f4b28b64090e60452d2e147279
    label: >-
      https://github.com/CollaboraOnline/online/commit/2d4469d27f0c52f4b28b64090e60452d2e147279
tags:
  - cve.org
epss: 0.00325
epssPercentile: 0.25696
ingestedAt: '2026-11-05T16:07:30.466Z'
---

## Overview

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.

## Affected

- `online < 24.04.18`
- `online >= 25.04.0-0, < 25.04.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.